Search recent repo activities

Fetch recent GitHub activity from the Nom feed

Security Scan

The skill is internally consistent: it only instructs the agent to fetch public feeds from beta.nomit.dev and summarize them, and it does not request extra credentials or install anything.

Purpose & Capability

Name/description say 'Fetch recent GitHub activity from the Nom feed' and the instructions only call the Nom API endpoints on beta.nomit.dev with curl and format results. No unrelated env vars, binaries, or installs are requested — the requested capabilities match the stated purpose.

Instruction Scope

SKILL.md only instructs fetching JSON or RSS from beta.nomit.dev and summarizing items; it does not reference local files, other env vars, or unrelated services. Note: it relies on a third‑party endpoint (beta.nomit.dev) rather than the official GitHub API — this is expected for the stated purpose but is a trust/availability consideration.

Install Mechanism

No install spec or code files (instruction-only). This is the lowest-risk option — nothing is written to disk or downloaded by the skill itself.

Credentials

The skill requires no environment variables, credentials, or config paths. That matches its use of a public feed and is proportionate.

Persistence & Privilege

always is false and the skill has no install hooks or configuration changes. It does not request persistent privileges or access to other skills' configuration.

Assessment

This skill is coherent and low-risk in its current form because it only performs public HTTP requests to beta.nomit.dev and formats results. Before installing, verify you trust the third-party feed host (beta.nomit.dev) — it will see request metadata and could supply misleading content. If you expect private or authenticated data, confirm the skill would require appropriate credentials (none are requested now). Also consider rate limits and whether you prefer data from GitHub's official API instead of a third-party aggregator.

Fetch GitHub activity from Nom (beta.nomit.dev) and present it clearly.

Base URL: https://beta.nomit.dev

$ARGUMENTS parsing rules:

• If the first argument looks like org/repo (contains /), use the repo feed at /api/feed/{org}/{repo}
• Otherwise use the global feed at /api/feed
• --search TEXT — free-text search (full-text on title/summary)
• --type TYPE — filter by event type: pull_request, issue, release, push
• --org ORG — filter by GitHub org (global feed only)
• --from DATE / --to DATE — date range (ISO 8601, e.g. 2026-01-01) (global feed only)
• --limit N — results to return (default 20, max 100)
• --rss — fetch RSS XML instead of JSON (repo feed: /api/feed/{org}/{repo}/rss; global: /api/feed/rss)

Build q for global feed by joining filters: e.g. type:pull_request org:vercel from:2026-01-01 plus any --search text.

API endpoints (JSON):

• Global feed: GET /api/feed
• Repo feed: GET /api/feed/{org}/{repo}

RSS endpoints (if --rss):

• Global: GET /api/feed/rss
• Repo: GET /api/feed/{org}/{repo}/rss

Use curl to fetch the response. For JSON, present results as a clean readable summary. For each item show:

• Event type label (PR / Issue / Release / Push)
• Title as a markdown link to the URL
• One-line AI summary
• Author and timestamp (relative if possible)

Response shape: { items: [...], pagination: { offset, limit, has_more } }. Each item has id, type, org, repo, title, summary, url, author, contributors, updated_at.

Example output format:

**PR** [Add turbo support](https://github.com/vercel/next.js/pull/123)
timneutkens · 2 hours ago
Adds experimental Turbo support to the build pipeline, cutting build times by ~40%.

**Release** [v14.2.0](https://github.com/vercel/next.js/releases/tag/v14.2.0)
vercel-release-bot · 1 day ago
Major release introducing partial pre-rendering and improved image optimisation.